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Abstract 

We develop a tableau-based decision procedure for 
the full coalitional multiagent temporal-epistemic 
logic of linear time CMATEL(CD+LT). It ex- 
tends LTL with operators of common and dis- 
tributed knowledge for all coalitions of agents. The 
tableau procedure runs in exponential time, match- 
ing the lower bound obtained by Halpern and 
Vardi for a fragment of our logic, thus providing 
a complexity-optimal decision procedure for CMA- 
TEL(CD+LT). 



1 Introduction 

Knowledge and time are among the most important 
aspects of multiagent systems. Various temporal- 
epistemic logics, proposed as logical frameworks for 
reasoning about these ascpects of multiagent systems 
were studied in a number of publications during the 
1980's, eventually summarized in a uniform and com- 
prehensive study by Halpern and Vardi [4] . In [4] , the 
authors considered several essential characteristics of 
temporal-epistemic logics: one vs. several agents, 
synchrony vs. asynchrony, (no) learning, (no) for- 
getting, linear vs. branching time, and the (non-) 
existence of a unique initial state. Based on these, 
they identify and analyze 96 temporal-epistemic log- 
ics and obtain lower bounds for the complexity of 
a satisfiability problem in each of them. It turns 
out that most of the logics with more than one 



agent who do not learn or do not forget, are unde- 
cidable (with common knowledge), or decidable but 
with non-elementary time lower bound (without com- 
mon knowledge). For the remaining multiagent log- 
ics, the lower bounds from [4J range from PSPACE 
(systems without common knowledge), through EX- 
PTIME (with common knowledge), to EXPSPACE 
(synchronous systems with no learning and unique 
initial state). To the best of our knowledge, how- 
ever, even for the logics from [4J with a relatively low 
complexity lower bound, no decision procedures with 
matching upper bounds have been developed. In this 
paper, we set out to develop such decision procedures 
based on incremental tableaux, starting with the mul- 
tiagent case over linear time, which involves no essen- 
tial interaction between knowledge and time. It turns 
out that, under no other assumptions regarding learn- 
ing or forgetting, the synchronous and asynchronous 
semantics are equivalent with respect to satisfiabil- 
ity. We consider a more expressive epistemic lan- 
guage than the ones considered in [4j, to wit, the one 
involving operators for common and for distributed 
knowledge for all coalitions of agents. We call the 
resulting logic CMATEL(CD+LT) {''Coalitional 
Multi- Agent Temporal Epistemic Logic with oper- 
ators for Common and Distributed knowledge and 
Linear Time"). The decision procedure for satisfia- 
bihty in CMATEL(CD+LT) developed herein runs 
in exponential time, which together with the lower 
bound for the fragment of CMATEL(CD+LT) 
obtained in [4], implies EXPTIME-complcteness of 
CMATEL(CD+LT). 
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2 The Logic 

CMATEL(CD+LT) 

2.1 Syntctx 

The language L of CMATEL(CD+LT) contains a 

set AP of atomic propositions, a sufficient repertoire 
of Boolean connectives, say -i ("not") and A ("and"), 
the temporal operators O ("next") and U ("until") 
of the logic LTL, as well as the epistemic operators 
D^(/) ("ii is distributed knowledge among agents in A 
that (^"), and Ca^ {'^it is common knowledge among 
agents of A that ip^^) for every non-empty ACE, 
where E is the set of names of agents belonging to 
C The set E is assumed to be finite and non-empty; 
its subsets are called coalitions (of agents). Thus, 
the formulae of C]V[ATEL(CD+LT) are defined as 
follows: 

ip := p \ ^ip \ {ipi Aif2) \ Qifi \ ((/?! U1P2) I D^v? I CaV 

where p ranges over AP and A ranges over the set of 
non-empty subsets of E, henceforth denoted V^{T,). 
We write (f € C to mean that (p is a formula of C. 

The operators of individual knowledge Kaf, where 
a e E {''agent a knows that ip"), can then be de- 
fined as D{a}¥', henceforth written Da</3. The other 
Boolean and temporal connectives can be defined as 
usual. We omit parentheses when this does not result 
in ambiguity. 

Formulae of the form -'Ca'^ are epistemic even- 
tualities, while those of the form ipUtp are temporal 
eventualities. 

N = {0, 1, . . .} denotes the set of natural numbers. 

2.2 Semantics 

Definition 2.1 A temporal-epistemic 
system (TES) is a tuple 25 = 
(E, S, R, {T^aIagp+cs), {^Si^eP+Cs))' where: 

1. E is a finite, non-empty set of agents; 

2. S is a set of states; 

3. R is a non-empty set of runs; where each r E R 
is a function r : N 5. A pair {r,n), where 
r € R and n & N, is called a point. The set 



of all points in 25 is denoted -P(25). Every point 
(r, n) represents the state r{n); note, however, 
that different points can represent the same state. 
4. for every A E 7'+(E), TZ'^ and TZ^ are binary 
relation on P(&), such that TZ'^ is the reflexive 
and transitive closure of [J a'caRa'- 

Definition 2.2 A temporal-epistemic 
frame (TEF) is a TES 25 

(E, S, R, {'R-A}Aev+{T:),{T^A}Aev+{S)), -where 
each TZ^ is an equivalence relation satisfying the 
following condition: (\) TZ^ = f) aGA'R-fa}- V 
condition ('\) is replaced by the following: ('\'\) 
T^A — whenever B C A, then ^ is a temporal- 
epistemic pseudo- frame (pseudo-TEF). 

Notice that, in (pseudo- )TEFs, TZ'^ is the transi- 
tive closure of (J aeAR^^} t^^us, an equivalence 
relation. 

Definition 2.3 A temporal-epistemic model (TEM, 
for short) is a tuple M. = {^,L), where 

(i) ^ is a TEF with a set of runs R; 

{ii) L : i?xN 1— > V{AP) is a labeling function, where 

L{r, n) is the set of atomic propositions true at 

(r, n). 

If the condition (i) is replaced by the requirement that 
^ is a pseudo- TEF, then M is a temporal-epistemic 
pseudo-model (pseudo-TEM) . 

A TES 6 is called synchronous if for every A G 
P+(E), if {{r,n),ir',n')) e TZ^, then n = n'. Syn- 
chronous temporal-epistemic (pseudo)-models are de- 
fined accordingly. Hereafter we consider the gen- 
eral case, but all definitions and results apply like- 
wise to the synchronous case, unless stated otherwise. 
The tableau construction can accommodate the syn- 
chronous case at no extra cost and eventually we show 
that, under no other assumptions, the presence or ab- 
sence of synchrony does not afi'ect the satisfiability of 
formulae. 

Definition 2.4 The satisfaction of formulae at 
points in (pseudo- ) TEMs is defined as follows: 
M, (r, n) Ih p iffp € L{r, n); 
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M, (r, n) !l — 'ip iff not M, (r, n) Ih tp; 

M, {r,n) Ih (pAip iff M, {r,n) Ih ip and M, {r,n) Ih 

^; 

M, {r,n) Ih O'/' iif A^, (r, n + 1) Ih yj; 

(r, n) Ih (y9 Uip iff M,{r,i) Ih ?/; /or some i > n 
such that A4, (r,j) Ih ip for every n < j < 

i; 

M,{r,n) hT)AP iffM,{r',n') hp 

for every ((r, n), (r', n')) G TV^', 

M,{r,n) rCAV €M,{r',n') Ih 

for every ((r, n), {r' ,n')) £ 7?,Ji^; 

Note, that in the semantics defined above the la- 
belling function acts on points, not states, i.e., it 
is point-based. To make the semantics state-based, 
one must impose the additional condition: if r(n) — 
r'{n') then L{r,n) = L{r' ,n'). However, for the case 
of linear time logics these two semantics are equiva- 
lent in terms of satisfiability and validity (this is an 
easy consequence of the fact that, in the linear case, 
all epistemic operators have built-in implicit univer- 
sal quantification over paths). 

The satisfaction condition for the operator Ca 
can be paraphrased in terms of reachability. Let 

be a (pseudo-) TEF over the set of runs R 
and let (r, n) G i? x N. We say that a point 
{r',n') is A-reachable from (r,n) if either r = r' 
and n — n' 01 there exists a sequence (r, n) = 
(ro,no), {ri,ni), . . . , {r„i-i,n.m-i), ir,n,nm) = 
{r',n') of points in i? x N such that, for ev- 
ery < i < m, there exists Ui € A such that 
((r^, n^), (r^+i, n^+i)) G . Then, the satisfac- 
tion condition for C^i becomes equivalent to the 
following: 

A4,{r,n) Ih Ca'P iff A4,{r',n') Ih ip whenever 
{r',n') is j4-reachable from (r,n). 

Satisfiability and validity in (a class of) models is 
defined as usual. 

It is easy to see that if S = {a}, then Da(y9 ^ Ca^ 
is valid in every TEM for every ip € C Thus, the 
single-agent case is essentially trivialized and, there- 
fore, we assume hereafter that S contains at least 2 
(names of) agents. 



3 Hintikka structures 

Even though we are ultimately interested in testing 
formulae of C for satisfiability in a TEM, the tableau 
procedure we present tests for satisfiability in a more 
general kind of semantic structures, namely a Hin- 
tikka structure. We will show that 6 € C is satisfi- 
able in a TEM iff it is satisfiable in a Hintikka struc- 
ture, hence the latter test is equivalent to the former. 
The advantage of working with Hintikka structures 
lies in the fact that they contain as much semantic 
information about 9 as is necessary, and no more. 
More precisely, while models provide the truth value 
of every formula of C at every state, Hintikka struc- 
tures only determine the truth of formulae directly 
involved in the evaluation of a fixed formula 9, in 
whose satisfiability we are interested. Another impor- 
tant difference between models and Hintikka struc- 
tures is that, in Hintikka structures the epistemic re- 
lations TZa and TZa only have to satisfy the properties 
laid down in Definition 12.11 All the other informa- 
tion about the desirable properties of epistemic rela- 
tions is contained in the labeling of states in Hintikka 
structures. This labeling ensures that every Hintikka 
structure generates a pseudo-model (by the construc- 
tion of Lemma [33]), which can then be turned into a 
model using the construction of Lemma 13.91 

Definition 3.1 ^ set A C C is fully expanded if it 
satisfies the following conditions (Sub(V') stands for 
the set of subformulae ofip): 

1. if -i^p G A then p G A; 

2. if p Alp e A, then p e A and tp G A; 

3. if -^{p Aijj) e A then ^p e A or ^p £ A; 

4. if ^Op> G A then O^p G A; 

5. if pU^ e A then tp e A or p, 0{pl(i)) G A; 

6. if -'{pUip) G A then -iip^-ip G A or 
-V,-0(^Z^V') G A; 

7. if D^(p G A then TiA'P S A for every A' such 
that ACA'Q E,- 

8. if Dap e A then p G A; 

9. if Ca^ G a then Da(</3 A Ca^) € A for every 
a G A: 

10. if^CAP G A then -iDa((^ A C^cp) G A for some 
a G A; 
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11. ifil^GA and 'Da'P G Sub('^) then either D^y € 
A or -i'Da'P G a. 

Deflnition 3.2 A temporal-epistemic 
Hintikka structure (TEHS) is a tuple 
(E, 5, R, {n'l}A(ir+{T.),{T^3^A(iV+{Y.),H) such 

that {^,S,R,{n'^}Aev+(Y.)A'^A}A(^v+(Y.)) is a 
TES, and H is a labeling of points in R x N with 
sets of formulae, satisfying the following conditions, 
for all (r, n) € Rx N; 

HI if-iifi e H{r,n), then (fi ^ H{r,n); 

H2 H{r, n) is fully expanded; 

H3 if Qip e H{r, n), then f e H{r, n + 1); 

H4 if ipUip € H{r,n), then there exists i > n such 
that ip G H{r,i) and G H{r,j) holds for every 
n<j< i; 

H5 if —Dap G H{r,n), then there exists r' € R 
and n' e N such that {{r,n), {r' ,n')) G TZ^ and 
-^(fi G H(r\n'); 

H6 if ((r, n), (r', n')) G 7^^, then D^' V G H{r, n) iff 
Da/(/9 G H{r',n'), for every A' C A; 

H7 if—iCA^ G H{r,n), then there exists r' G R and 
n' G N SMc/i iftai ((r, n), (r', n')) G T?.^ and -^ip G 
if(r',n'). 

Synchronous TEHSs (STEHSs) are defined likewise. 

Definition 3.3 A set of formulae 6 is satisfiable in 
a TEHS H with a labeling function H if there exists a 
point (r, n) G H such that O C H{r,n). Analogously 
for formulae. 

Now, we show that € C is satisfiable in a TEM 
iff it is satisfiable in a TEHS. One direction is al- 
most immediate, as every TEM naturally induces a 
TEHS. More precisely, given a TEM M, define the 
extended labeling L+ on the set of points of M as 
follows: L^{r,n) = {(p \ M,{r,n) \\- p} for every 
(r, n). The following claim is then straightforward. 

Lemma 3.4 Let M = {d, L) be a TEM satisfying 
C, and let be the extended labeling on M.. 
Then, H = {S,AP,L+) is a TEHS satisfying 9. 



For the opposite direction, wc first prove that the 
existence of a TEHS satisfying implies the existence 
of a pseudo-model satisfying 0; then, we show that 
this in turn implies the existence of a model satisfying 
0. 

Lemma 3.5 Let E C he such that there exists a 
TEHS for 0. Then, is satisfiable in a pseudo-TEM. 

Proof. Let 7i = 

(S, S, R, {'R-A}Aer+cs:), {"^aIag-p+cs)) 
H) be a TEHS for 0. We build a pseudo- 
TEM satisfying as follows. First, for every 
A e V+{J:), let TZ'f be the reflexive, symmet- 
ric, and transitive closure of IJ acbT^b ^^'^ 
TZ'^ be the transitive closure of IJ aeATZ'^. No- 
tice that C n'f and TZ^ C TZ'^ for every 
A e P+(E). Next, let L{r,n) = H{r,n) fl AP, 
for every point (r, n) £ R x N. It is then easy 
to check that M' = {T,, S, R, {n'f}Aev+(^), 
{7?.^}ag7'+(s),AP, L) is a pseudo-TEM. It is also 
easy to check that the construction preserves 
synchrony. 

To complete the proof of the lemma, we show, by 
induction on the formula x G £ that, for every point 
(r, n) and every x G £, the following hold: 

(i) X G H{r, n) implies M' , (r, n) Ih x; 

(ii) -IX G Hi^, n) implies 7W, (r, n) II — 'X- 

Let X be some p e AP. Then, p e H{r,n) implies 
p G L{r,n) and thus, M' , (r, n) Ih p; if, on the other 
hand, -ip £ H{r,n), then due to (HI), p ^ H{r,n) 
and thus p ^ L{r,n); hence, M',{r,n) II — 'p. 

Assume that the claim holds for all subformulae of 
X; then, wc have to prove that it holds for x, as well. 

Suppose that x = If G H{r, n), then the in- 
ductive hypothesis immediately gives us M' , (r, n) Ih 
-ip; if, on the other hand, -i-ip G H{r,n), then by 
virtue of (H2), (p G H(r,n) and hence, by induc- 
tive hypothesis, A4', (r, n) Ih p and thus M', (r, n) Ih 

The cases of x = 9? A ^ and X = Op are straight- 
forward, using (H2) and (H3). 

Suppose that x = 'DaP- Assume, first, that 
T)aP G H{r,n). In view of the inductive hypothesis, 
it suffices to show that ((r, n), (r',n')) G TZ'^ implies 
(p G H{r,n). Assuming {{r,n),{r' ,n')) G TZ'^ , there 
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are two cases to consider. If (r, n) — {r',n'), then 
the conclusion immediately follows from (H2). Oth- 
erwise, there exists an undirected path from (r, n) to 
{r',n') along the relations 'R-'^i, where each A' is a 
superset of A. Then, due to (H6), T^Af G H{r',n'); 
hence, by (H2), (p G H{r',n'), as desired. 

Now, let -iD^iy9 G H{r,n). By (H5), there exist 
r' e i? and n' e N such that {{r,n),ir' ,n')) G TZ^ 
and -^ip e H{r',n'). As C 7^^, the claim follows 
from the inductive hypothesis. 

Suppose that x = CaP>- Assume that CaP> G 
H{r,n). By inductive hypothesis, it suffices to 
show that if (r',n') is ^-reachable from (r, n), then 
(fi e H{r',n'). If (r, n) = the claim fol- 

lows from (112). So, suppose for some m > 1, 
there exists a sequence of points (r, n) = (ro, np), . . . , 
{rm-i,nm-i),{rm,njn) = ('''jn') such that, for ev- 
ery < i < TO, there exists £ A such 
that (ri+i,ni+i)) £ 7^^^. Then, for ev- 

ery < i < TO, there exists a,; £ A such that 
((''i, 'T'i): (^i+ii '^i+i)) ^ i?ai • We Can then show by 
induction on i, using (112) and (116), that Ca^P £ 
H{ri,ni) holds for every << to; hence, T^ati'P A 
CAf/?) £ H{ri,ni). Therefore, (p £ iJ(ri+i, rii+i) 
by (H2) and (116). By taking i = to — 1 we obtain 
ip £ H{r',n'), as required. 

Now, assume -iCaP £ H{r,n). Then, the claim 
follows from (HZ) and the inductive hypothesis, since 

Suppose that X = '■pUip- If pUtl) £ H{r,n), 
then the conclusion immediately follows from 
(H4) and the inductive hypothesis. Suppose, on 
the other hand, that -^{ipUip) £ H{r,n). Then, 
by (H2), -^ip,^p £ H{r,n) or -^tp, O^iifiUip) 
£ H{r, n). In case former case, the inductive hypoth- 
esis immediately gives us the desired result. In the 
latter, inductive hypothesis gives us A4,{r,n) ))f ip 
and (113) gives us ^{ipUip) £ H{r,n + 1). Now 
the argument can be repeated. Ultimately, us- 
ing inductive hypothesis, we either get a finite 
path (r, n), . . . , (r, i) such that M, (r,i) ip and 
A4, (r, j) F tp holds for all n < j < z, or we get an in- 
finite path {r,n),{r,n+l), . . . such that Ai, {r,i) Ik^ ip 
for all i > n. In either case, A^, (r, n) ¥ tpUip. □ 



To show that satisfiability of a formula in a pseudo- 
TEM implies its satisfiability in a TEM, we use a 
modification of the construction from [TJ Appendix 
Al] (see also [B]). 

Definition 3.6 Lef = (S, 5, i?, {7^2}AeP+(E) , 
{^a}ag'P+(e)i -^-^i ^ (pseudo-)TEM and 
let r,r' £ R and n, n' £ N. A maximal 
path from {r,n) to {r\n') in M. is a sequence 
{r,n) = (ro,7io),^o, (?'i,«i), • ■ • ,A„i_i, (r„,n„) 
= {r',n') such that, for every 

< i < m, {{ri,ni),{ri+i,ni+i)) 
£ n^^, but {{ri,ni),{r^+i,ni+i)) ^ TZj^ for any 
B such that Ai <Z B C_ "E. A segment p' of a maximal 
path p starting and ending with a point is a sub-path 
of P- 

Definition 3.7 Let p = 

(ro, no), j4o . . . , /l„_i, (r^, Um) be a maximal path in 
A4. The reduction of p is obtained by, first, replac- 
ing in p every longest sub-path {rp,np), Ap, (rp^i, 
Up+i) . . . ,Ap+q^i,{rp+g,np+q) such that 

Tp — Tp+i ~ ... ^ '''p+q with rp (i.e., eliminat- 
ing loops) and, then, by replacing in the resultant 
path every longest sub-path {rj,nj),Aj,{rj^i, 
nj+i) . . . , Aj+,n~i, irj+,n,nj+m) such that Aj = 
Aj+i = . . . = Aj+m-i with {rj,nj), Aj, {rj+rn,nj+rn) 
(reducing multiple transitions along the same relation 
into a single transition). A maximal path is reduced 
if it equals its reduction. 

Definition 3.8 A (pseudo-)TEM M is forest-like if, 
for every r,r' G R and every n, n' £ N, there exists at 
most one reduced maximal path from (r, n) to [r' , n'). 

One difference of the construction presented below 
from the one in [H Appendix Al] is that, instead 
of producing a tree-like model, we rather produce a 
forest-like one, partly since every "temporal level" 
of the model we are going to build will not be con- 
nected by epistemic relations to any other temporal 
level, and partly because even within a single tempo- 
ral level we will, in general, construct more than one 
"epistemic tree" . 

Lemma 3.9 If £ C is satisfiable in a (syn- 
chronous) pseudo-TEM, then it is satisfiable in a 
(synchronous) forest-like TEM. 
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Proof. Wc will only consider the syn- 

chronous case, as it requires extra care. Sup- 
pose that 6 is satisfied in a synchronous 
pscudo-TEM M = (E, S", i?, {7^^}^gp+(s), 
{^A}AeP+(E); AP, L) at a point {r,n). To build 
a synchronous forest-like TEM M.' satisfying 6, we 
use the modified tree-unraveling technique. First, 
every "epistemic tree" within a temporal level of the 
model will be made up of all maximal paths, rather 
than all paths, as in the standard trce-imraveling, 
since we want to ensure that paths between points 
are unique with respect to the relations TZ^ indexed 
by maximal coalitions, which will allow us to fix 
"defects" with respect to the £)-relations. Second, 
every level will, in general, be made up of more than 
one epistemic tree, as every point at level m ^ 
created as part of temporal run starting at a level 
k < m, will be a root of a separate tree. 

The construction starts by taking a submodel 
M(r,n) of A4 generated by the point x = {r,n) at 
which 9 is satisfiable. 

Next, we define A4' by recursion on the temporal 
levels. We view a level k as partitioned into clusters 
{S^, . . .}, such that if ((r, k), (r', k)) G S'f , there is 
an (undirected) path along D-relations between (r, k) 

and (r', k). 

We start from level 0, corresponding to level n in 
A4 and level in M(^r,n)- This level contains only 
one cluster 5*°, generated by point x. In general, 
however, a level k will have more than one clus- 
ter, so we describe the construction in more general 
terms. At level fc, for each cluster S^, we choose 
arbitrarily a point {ri,k) e S'f (at level 0, how- 
ever, we choose x); this point is going to be the 
root of an epistemic tree associated with that clus- 
ter. Now, we call a maximal path p in M. a {ri,k)- 
max-path if the first component of p is {ri,k). We 
denote the last element of p by l{p). Notice; that 
{ri,k) is by itself an (rj, A;)-max-path. Now, let S^ 
be the set of all (rj, A:)-max-paths in M. For every 

A e P+(S), let 7e*2 = {ip,p') I G U and 
p' = p, A,l{p')}. Let, furthermore, TZ'^ to be the 
reflexive, symmetric, and transitive closure of TZ*^. 
Notice that {p, p') G TZ'^ holds iff one of the paths p 
and p' extends the other by a sequence of A-steps. 



Therefore, two different states in IJ i can only 
connected by TZ'^ for at most one maximal coalition 
A. Further, we stipulate the following downwards clo- 
sure condition: whenever (/?, t) G TZ'^ and B Q A, 
then (p, t) G TZ'I^ . The relations TZ'^ are then defined 
as in any TEF. 

We next describe how to create level m+l of TM' as- 
suming that level m has already been defined. First, 
carry out for m -|- 1 the construction described in the 
previous paragraph for an arbitrary level k. Secondly, 
for every pair of states p G IJ » 5™ and r G IJ i 5*™+^ 
make (r, m -|- 1) a temporal successor of (p, m) if 1{t) 
is a such successor of l{p) in M.. 

To complete the definition oi M' , we put L'{p) = 
L{l{p)) for every p G P{M'), where P{M') is the 
set of points of A^'. It is clear from the construc- 
tion, namely from the downward saturation condi- 
tion above, that M' is a synchronous pseudo-TEM. 
Wc now show that it is a TEM satisfying 9. 

To prove the first part of the claim, we need 
extra terminology. We call a maximal path 
pi^ Ai^ P2, ■ ■ ■ , An-iT Pn in fA' primitive if, for ev- 
ery < z < n, either {pi,pi+i) G TZ*^, or 
{pi+i,Pi) e TZ*^.. A primitive path pi, Ai, p2, . . . , 
An-i,Pn is non-redundant if there is no < i < n 
such that Pi = pi+2 and A^ = Aj+i. Intuitively, in 
a non-redundant path we never go from a state p 
(forward or backward) along a relation and then im- 
mediately back to p along the same relation. Since 
the relations IZ*'^ are edges of a tree, it immediately 
follows that [S' denotes the state space of Ai'): 

(J) for every pair of states p, r G 5", there exists at 
most one non-redundant primitive path from p 
to r. 

Lastly, we call a primitive path pi, A, p2, A, pn an 
A-primitive path. 

We will now show that maximal reduced paths 
in M' stand in one-to-one correspondence with 
non-redundant primitive paths. It will then fol- 
low from (J) that maximal reduced paths between 
any two states of M' are unique, and thus A4' 
is forest-like, as claimed. Let P = pi,Ai,..., 
An-i, Pn, where pi = p and p„ = r, be a maximal re- 
duced path from p to r in M.'. Since {pi, Pi+i) G TZ'^. , 
there exists a non-redundant ^j-primitive path from 
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Pi to pi+i, which in view of (|) is unique. Let us ob- 
tain a path P' from p to r by replacing in p every Hnk 
(pi,Ai^ pi+i) by the corresponding non-redundant Ai- 
primitive path from pi to Pi+i- Call P' an expansion 
of P. In view of (|), every path has a unique expan- 
sion. Now, it is easy to see that P is a reduction of P' . 
Since the reduction of a given path is unique, too, it 
follows that there exists a one-to-one correspondence 
between reduced paths and non-redundant primitive 
paths in M' . 

We now prove that IV^ ~ {~\ aeA^'^ for every 
A e and hence M' is a TEM. The left to right 

inclusion is immediate, as M.' is pseudo-TEM. For 
the other direction, assume that ((r, n), (r', n)) S TZ'^ 
holds for every a G A. Then, for every a G A, there 
exists a path, and therefore a maximal reduced path, 
from (r, n) to {r',n) along relations TZ'^, such that 
a ^ A' . As A^' is forest-like, there is only one maxi- 
mal reduced path from (r, n) to (r', n). Therefore, the 
relations TZ^, linking (r, n) to (r' , n) along this path 
are such that A A' for every A'. Then, by the 
downwards closure condition, there is a path from 
(r, n) to {r',n) along the relation TZ'^ and, hence, 
{{r,n), {r' ,n)) G TZ'^ , as desired. 

Finally, it remains to prove that A4' satisfies 
9. First, notice that {p, r) G 7?.^ iff there exists 
an A-primitive path from p to r. Hence, as every 
TZa is an equivalence relation, if (p, t) G TZ'j^, then 
{1{p),1{t)) G TZ'^. It is now straightforward to check 
that the relation Z — {{pj{p) \ p G S" } is a bisim- 
ulation between M' and M. Since {x,l{x)) G Z, it 
follows that Ai', X II- 6, and we are done. □ 



Theorem 3.10 Let 6 E C. Then, 9 is satisfiable in 
a TEM iff there exists a TEHS satisfying 9 . 

Proof. Immediate from Lemmas 13. 4[ 13.51 and 13.91 □ 



4 Tableaux for 

CMATEL(CD + LT) 

In the present section, we describe the tableau pro- 
cedure for testing formulae of CMATEL(CD+LT) 



for satisfiability in synchronous systems, as this case 
requires more care. We then briefly mention how to 
modify the procedure for asynchronous case and ar- 
gue the the output of both procedures for the same 
input formula is the same, implying the equivalence 
of two semantics. 

4.1 Overview of the tableau proce- 
dure 

The tableau procedure for testing a formula 9 E C 
for satisfiability attempts to construct a non-empty 
graph (called tableau), whose nodes are finite sub- 
sets of C, representing sufficiently many TEHSs, in 
the sense that, if 9 is satisfiable in a TEHS, it is sat- 
isfiable in a one represented by a tableau for 9. The 
philosophy underlying our tableau algorithm is essen- 
tially the same as the one underpinning the tableau 
procedure for LTL from [7] , recently adapted to mul- 
tiagent epistemic logics in [5]; this philosophy can 
be traced back to [S]. To make the present paper 
self-contained, we outline the basic ideas behind our 
tableau algorithm in line with those references. The 
particulars of the tableaux presented here, however, 
are specific to CMATEL(CD+LT). 

Usually, tableaux work by decomposing the input 
formula into simpler formulae. In the classical propo- 
sitional case, "simpler" implies shorter, thus ensuring 
the termination of the procedure. The decomposi- 
tion into simpler formulae in the tableau for classical 
propositional logic produces a tree representing an 
exhaustive search for a Hintikka set (the classical ana- 
logue of Hintikka structures) for the input formula 9. 
If at least one leaf of that tree produces a Hintikka set 
for 9, the search has succeeded and 9 is pronounced 
satisfiable; otherwise it is declared unsatisfiable. 

When applied to logics containing fixpoint- 
definable operators, such as Ca and U, these two 
defining features of the classical tableau method no 
longer apply. First, the decomposition of fixpoint 
formulae, which is done by unfolding their fixpoint 
definitions, produces larger formulae: Ca^ is decom- 
posed into formulae of the form Da(iy3 A C^(p), while 
ipUtp is decomposed into 'ip and ipAO{ipUip). Hence, 
we need a termination-ensuring mechanism. In our 
tableaux, such a mechanism is provided by the use 
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(and reuse) of so called "prestates" , whose role is to 
ensure the finiteness of the construction and, hence, 
termination of the procedure. Second, the only rea- 
son why a tableau may fail to produce a Hintikka set 
for the input formula in the classical case is that ev- 
ery attempt to build such a set results in a collection 
of formulae containing a patent inconsistency, i.e., a 
complementary pair of formulae tp, -itp. In the case 
of CMATEL(CD+LT), there are other such rea- 
sons, as the tableaux in this case are meant to rep- 
resent TEHSs, which are more involved structures 
than classical Hintikka sets. One additional reason 
has to do with eventualities: the presence of an even- 
tuality -iCaV' in the label of a state s of a TEHS H 
requires the existence in Ti, of an A-path from s to 
a state t whose label contains -Kp (condition (H7) of 
Definition 13. 2p . An analogous requirement applies to 
eventualities of the form (pUtlj due to condition (H4) 
of Definition 13. 21 The tableau analogs of these condi- 
tions is called realization of eventualities. If a tableau 
contains nodes with unrealized eventualities, then it 
cannot produce a TEHS, and thus it is "bad". The 
third possible reason for a tableau to be "bad" has 
to do with successor nodes: it may so happen that 
some of the successors of a node s which are necessary 
for the satisfaction of s are unsatisfiable. Notice that 
TEHSs, and consequently the associated tableaux, 
contain two kinds of "successor" nodes: temporal 
and epistemic. The non-satisfiability of either kind 
of successor can ruin the chances of a tableau node 
to correspond to a state of a TEHS. 

The tableau procedure consists of three major 
phases: pretableau construction, prestate elimination, 
and state elimination. During the pretableau con- 
struction phase, we produce a directed graph — 
called the pretableau for 9 — whose set of nodes prop- 
erly contains the set of nodes of the tableau we 
are building. The nodes of are sets of formu- 
lae of two kinds: states and prestates. States are 
fully expanded sets, meant to represent (labels of) 
states of a Hintikka structure, while prestates play 
a temporary role in the construction of T^. During 
the prestate elimination phase, we create a smaller 
graph Tq out of , called the initial tableau for 9, 
by eliminating all the prestates from and accord- 
ingly redirecting its edges. Finally, during the state 



elimination phase, we remove from Tq all the states, 
if any, that cannot be satisfied in a TEHS, either be- 
cause they contain unrealized eventualities or because 
they lack a necessary successor (patently inconsistent 
states are removed "on the fly" during the state cre- 
ation stage). The elimination procedure results in a 
(possibly empty) subgraph of Tq , called the final 
tableau for 9. If some state A of contains 9, we 
declare 9 satisfiable; otherwise, we declare it unsatis- 
fiable. The construction of the tableau is illustrated 
in Example [T] given at the end of Section 14.41 

4.2 Pretableau construction phase 

All states and prestates of the pretableau con- 
structed during this phase are "time-stamped" , the 
notation pI"! indicating that prestate F was created 
as the nth component of a run; analogously for states. 

The pretableau contains three types of edge, de- 
scribed below. As already mentioned, a tableau at- 
tempts to produce a compact representation of a suf- 
ficient number of TEHSs for the input formula, which 
are the result of an exhaustive search for a TEHS sat- 
isfying 9. One type of edge, depicted by unmarked 
double arrows represents the search dimension of 
the tableau. Exhaustive search considers all possible 
alternatives, which arise when expanding prestates 
into states by branching when dealing with the "dis- 
junctive formulae". Thus, when we draw a double 
arrow from a prestate F to states A and A' (depicted 
as F =^ A and F =4> A', respectively), this intu- 
itively means that, in any TEHS, a state whose label 
extends the set F has to contain at least one of A 
and A'. Our first construction rule, (SR), prescribes 
how to create tableau states from prestates. 

Given a set F C we say that A is a minimal 
fully expanded extension o/ F if A is fully expanded, 
F C A, and there is no A' such that F C A' C A and 
A' is fully expanded. 

Rule (SR) Given a prestate F^ such that (SR) 
has not been applied to (SR) earlier, do the follow- 
ing: 

1. Add all minimal fully expanded extensions A I"! 
of F["1 that are not patently inconsistent as 
states; 
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2. if AI"! contains no formulae O^^, add OT to it; 

3. for each so obtained state A^"!, put PI"! 

AN; 

4. if, however, the pretableau aheady contains a 
state A'!™! that coincides with A^^ do not cre- 
ate another copy of A'!"*!, but only put Pl"! => 

We denote by states(r["l) the set of states {A 
p["] =^ /\ }_ Note that we remove patently incon- 
sistent states "on the fly", thus never making them 
part of a pretableau. 

Notice that in all construction rules, as in (SR), 
we allow reuse of (pre)states, which were originally 
stamped with a possibly different time-stamp. This 
does not correspond to one state or prestate be- 
ing part of two different runs, at different moments 
of time (the absolute time is supposed to be the 
same in all runs, even though agents may not be 
able to observe it, in asynchronous systems); rather, 
the "futures" of these runs, starting from the reused 
(pre)state can be assumed to be identical, modulo 
the time difference. 

The second type of edge in a pretableau repre- 
sents epistemic relations in the TEHSs that the pro- 
cedure attempts to build. This type of edge is rep- 
resented by single arrows marked with epistemic for- 
mulae whose presence in the source state requires the 
presence in the tableau of a target state, reachable 
by a particular epistemic relation. All such formulae 
have the form -iD^(/3 (as can be seen from Defini- 
tion [3T21)- Intuitively if, say -^DAf & A^^\ then we 
need some prestate F^"! containing -^ip to be accessi- 
ble from AI"! by TZ^ (notice that the newly created 
prestates bear the same time stamp as the source 
state; this reflects the fact that we are considering 
the synchronous case). The reason we mark these 
single arrows not just by a coalition A, but by a for- 
mula -iD^iy9, is that we have to remember not just 
what relation connects states whose labels contain 
AN and r["l^ but why we had to create this par- 
ticular r["l. This information will be needed when 
we start eliminating prestates, and then states. We 
now formulate the rule producing this second type of 
edges in the pretableau. 

Rule (DR): Given a state A^ such that -^T>Atp e 



A["l, aW and (DR) has not been appHed to AW 
earlier, do the following: 

1. Create a new prestate pN ~ {""y'} U 
Ua'ca{D^,^ I Ba'^ e AN} u 
U A'caI-D^'V- I -D^'^e AN}; 

2. connect AI"! to tI"! with "^'^; 

3. if, however, the tableau already contains a 
prestate F'l"! — pI"!, do not add another copy 
of r'N, but simply connect AN to T't"] with 

Lastly, the third type of edge, depicted by sin- 
gle unmarked arrow — >, represents temporal tran- 
sitions. We now state the rule that creates such ar- 
rows. 

Rule (Next): Given a state AN such that 
(Next) has not been applied to A^"] earlier, do the 
following: 

1. Create a new prestate r["+^l — {(p \ Qnp G 
AN }; 

2. connect AN to r["+il with — >; 

3. if, however, the tableau already contains a 
prestate F'l™! = r["+^l, do not add another copy 
of r'Nl, but simply connect AI"! to r'Nl with 

Note that, due to step 2 in (SR), every state con- 
tains at least one formula of the form CiLp. 

Having stated the rules, we now describe how the 
construction phase works. We start off by creating 
a single prestate {0}, where 9 is the input formula. 
Then we alternatingly apply (DR) and (Next) to 
the prestates created at the previous stage and then 
applying (SR) to the newly created states. The con- 
struction state is over when the applications of (DR) 
and (Next) do not produce any new prestates. 

4.3 Prestate elimination phase 

At this phase we remove from all the prestates 
and double arrows, by applying the following rule: 

Rule (PR) For every prestate F in , do the 
following: 

1. Remove F from V^] 
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2. if there is a state A in with A ^ T, then 
for every state A' G states(r), put A A'; 

3. if there is a state A in "P^ with A — > T, then 
for every state A' G states (F), put A — > A'. 

The resulting graph, denoted Tq , is called the ini- 
tial tableau. 

4.4 State elimination phase 

During this phase we remove from Tq states that are 
not satisfiable in a TEHS. There are two reasons why 
a state A of Tq can turn out to be unsatisfiable: ei- 
ther satisfiability of A requires satisfiability of some 
other (epistemic or temporal) successor states which 
are unsatisfiable, or A contains an eventuality that 
is not realized in the tableau. Accordingly, we have 
three elimination rules (as two different rules deal 
with epistemic and temporal successors): (ElE), 
(EIT), and (E2). 

Formally, the state elimination phase is divided 
into stages; we start at stage with Tq; at stage 
n + 1 we remove from the tableau obtained at 
the previous stage exactly one state, by applying one 
of the elimination rules, thus obtaining the tableau 
We state the rules below, where denotes 
the set of states of 7^^ . 

(ElE) If A e S*^ contains a formula x = "'Da'P 
and A A' does not hold for any A' e S^, obtain 
T^^i by eliminating A from T^. 

(EIT) If If A G S^, and A — > A' does not hold 
for any A' G S*^, obtain T^+i by eliminating A from 

■'n • 

For the third elimination rule, we need the concept 
of eventuality realization. We say that the eventu- 
ality -iCyi</3 is realized at A in 7^ if there exists a 
finite path A = Aq, Ai, . . . , A^ (where m > 0) such 
that -^ip G A„i and for every < i < m there ex- 
ist Xi — ^B'ipi such that B C A and Aj A^+i. 
Analogously, we say that the eventuality ip Uil> is re- 
alized at A in 7jf if there exists a finite path A = 
Aq, Ai, . . . , Ajn (where w > 0) such that tp G A^, 
and for every < i < m, both Aj — > Aj+i and 
1^ G Aj hold. 



(E2) If A G 5^ contains a (temporal or epistemic) 
eventuality ^ that is not realized at A in 7^, then 
obtain by removing A from 7^. 

We check for realization of eventualities by run- 
ning the following iterative procedure that eventually 
marks all states that realize a given eventuality ^ in 

. If ^ = -iCyicp, then initially, we mark all A G 5^ 
such that G A. Then, we repeat the following 
procedure until no more states get marked: for every 
still unmarked A G S*^, mark A if there is at least 

one A' such that A — ^ A' for some B C A and A' is 
marked. The procedure for eventualities of the form 
(fiUip is analogous. 

We have so far described individual rules and their 
implementation; to describe the state elimination 
phase as a whole, we need to specify the order of 
their application. We need to be careful, as hav- 
ing applied (E2), we could have removed all the 
states accessible from some A either along the ar- 
rows marked with an epistemic formula x or along un- 
marked arrows — >; hence, we need to reapply (ElE) 
and (EIT) to the resultant tableau to remove such 
A's. Conversely, having apphed (ElE) and (EIT), 
we could have thrown away some states that were 
needed for realizing certain eventualities; hence, we 
need to reapply (E2). Therefore, we need to apply 
(E2), (ElE), and (EIT) in a dovetailed sequence 
that cycles through all the eventualities. More pre- 
cisely, we arrange all eventualities occurring in Tq in 
a list ^1, . . . ,^m- Then, we proceed in cycles. Each 
cycle consists of alternatingly applying (E2) to the 
pending eventuality (starting with ^i), and then ap- 
plying (ElE) and (EIT) to the resulting tableau, 
until all the eventualities have been dealt with, i.e., 
we reached These cycles are repeated until no 
state is removed in a whole cycle. Then, the state 
elimination phase is over. 

The graph produced at the end of the state elimi- 
nation phase is called the final tableau for 6, denoted 
by T^ and its set of states is denoted by S^. 

Definition 4.1 The final tableau T^ is open if 6 G 
A for some A e. ; otherwise, T^ is closed. 

The tableau procedure returns "no" if the final 
tableau is closed; otherwise, it returns "yes" and. 
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moreover, provides sufficient information for produc- 
ing a finite pseudo-model satisfying 9] that construc- 
tion is sketched in Section O 

Example 1 In this example, we show how our pro- 
cedure works on the formula -'C^a,b}P^^{a,c}P- Be- 
low is the complete pretableau for this formula. 




XI = ^Da(p A C{„_b}p); X2 = ^D6(pAC{j,^i,}P); 

To = {-.C{a,6}p WD{a,c}P = 8}; 

Ai = {e,-C{,,i,}p, Oe,xi}; A2 = {D{„,,}p,p, OT}; 

A3 = {0,-C{„,i,}P, Oe,X2}; Ti = {Xl,-(P A C{„,,}p)}; 

r2 = {X2,-{pAC{„^,}p)}; A4 = {Xl,-P, OT}; 

As = {xi,-C{„,i,}P, OT}; Ae = {xi, -C{,.,,}p, X2, OT}; 

At = {X2, -C{,,,}p, OT}; As = {X2, -P, OT}; 

r3 = {T};A9 = {T, OT}. 

The initial tableau is obtained by removing all 
prestates (the Ts) and redirecting the arrows (i.e, Ai 
will be connected by unmarked single arrows to itself, 
A2, and Aaj. It is easy to check that no states get re- 
moved during the state elimination stage; hence, the 
tableau is open and 9 is satisfiable. 

We now briefly mention how to modify the above 
procedure for the asynchronous case. The only differ- 
ence occurs in the (DR) rule: we now longer require 
that prestates produced during the application of this 
rule to a given state AI"! should have the same time 
stamp as A (namely, n) . A brief analysis of the pro- 
cedure shows that this modification does not change 
the outcome of the procedure for a given formula. 
This, in particular, implies that the satisfiability-wise 
equivalence of synchronous and asynchronous seman- 
tics. 



5 Soundness, completeness, 
and complexity 

The soundness of a tableau procedure amounts to 
claiming that if the input formula 9 is satisfiable, then 
the tableau for 9 is open. To establish soundness of 
the overall procedure, we use a series of lemmas show- 
ing that every rule by itself is sound; the soundness 
of the overall procedure is then an easy consequence. 
The proofs of the following three lemmas are straight- 
forward. 

Lemma 5.1 Let V be a prestate of such that 
A^,(r, n) Ih r for some TEM A4 and point {r,n). 
Then, M,{r,n) Ih A holds for at least one A G 
states(r). 

Lemma 5.2 Let A e S^, for m > 0, be such that 
A4,{r,n) Ih A for some TEM Ai and point (r, n), and 
let -iT)a'^ £ Then, there exists a point {r',n') G 
M such that ((r, n), {r',n')) G T?.^ and M, [r' , n') Ih 
A' where A' = {-.95} U Q a'ca{Da'V' I Da'^A G 
A } U U A'^a{ -D^'^ I -D^'V^ e A }. 

Lemma 5.3 Let A G S^, for m > 0, be such that 
A4,{r,n) Ih A for some TEM M. and a point {r,n). 
Then, M,{r,n + 1) Ih 0(A) where 0(A) = {ip \ 
Oif G A}. 

Lemma 5.4 Let A G S^, for m > 0, be such that 
M, {r,n) Ih A for some TEM Ai and a point (r, n), 
and let -^Cj^ip G A. Then, -^Cj^ip is realized at A in 

r« 

Proof idea. Since ^CAf is true at s, there is a path 
in AA from s leading to a state satisfying -11^9. Since 
the tableau performs exhaustive search, a chain of 
tableau states corresponding to those states in the 
model will be produced. □ 

The next lemma is proved likewise. 

Lemma 5.5 Let A G S^, for m > 0, be such that 
A4, {r,n) Ih A for some TEM Ai and a point (r, n), 
and let ipU'tjj G A. Then, ipUip is realized at A in 
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Theorem 5.6 If 9 £ C is satisfiable in a TEM, then 
is open. 

Proof sketch. Using the preceding lemmas, we 
show by induction on the number of stages in the 
state ehmination phase that no satisfiable state can 
be eliminated due to any of the elimination rules. 
The claim then follows from Lemma [STTl □ 

The completeness of a tableau procedure means 
that if the tableau for a formula 9 is open, then 9 
is satisfiable in a TEM. In view of Theorem 13. 10) it 
suffices to show that an open tableau for 9 can be 
turned into a TEHS for 9. 

Lemma 5.7 // is open, then a (synchronous) 
TEHS for 9 exists. 

Proof sketch. The TEHS H for 9 is buih by in- 
duction on the temporal levels, in order to take care 
of synchrony. The main concern is to ensure that 
all eventualities in the resultant structure are real- 
ized (all other properties of Hintikka structures eas- 
ily transfer from an open tableau). We alternate be- 
tween realizing epistemic eventualities (formulae of 
the form ^C^v) and temporal eventualities (formu- 
lae of the form (pUtp). 

We start by building the 0th level of our prospec- 
tive Hintikka structure from the level of the open 
tableau. For each state A^"! on this level, if A^"! 
does not contain any epistemic eventualities, we de- 
fine epistemic component for A^ to be A^^l with 
exactly one successor reachable by for each 

^D^V' G AM; if, on the other hand, -^CaV S A™, 
then such a component is a tree obtained from a path 
in the tableau realizing ^Ca^^ at A^ by giving each 
component of the path "enough" successors, as de- 
scribed above. We recursively repeat the procedure 
extending the current tree by attaching to its leaves 
associated components. As all the unrealized epis- 
temic eventualities are propagated down the compo- 
nents (hence, appear in the leaves of the tree), we 
can stitch them up together to obtain a structure in 
which epistemic eventuality is realized. 

Now, having built the 0th level of our prospective 
Hintikka structure, we take care of realizing all the 



temporal eventualities contained in the states of level 
0. This is done exactly as in the completeness proof 
of the tableau procedure for LTL: we define the tem- 
poral component for each A[°1 as follows: if A[°1 does 
not contain any temporal eventualities, then we take 
AM with one of its temporal successors; otherwise, 
we take a temporal path realizing (^^^-0 G A^"!. As 
eventualities are again passed down, we can stitch up 
an infinite, or ultimately periodic, path realizing all 
the eventualities contained in the states making up 
the path. 

Next, we repeat the procedure inductively. For the 
mth epistemic level, we independently apply to each 
state on this level the procedure described above for 
level 0, so that "epistemic structures" unfolding from 
any two points on level m are disjoint, and also give 
to each newly created point a "history" consisting of 
a path of TO — 1 states of the form {T} (so that we 
do not create any new epistemic eventualities at the 
levels we have already "processed" ) . Having fixed all 
the epistemic eventualities at the TOth level, we repeat 
the procedure described in the previous paragraph to 
fix all the temporal eventualities contained in states 
of level TO. 

Thus, we produce a chain of structures ordered by 
inclusion. Eventually, we take the (infinite) union of 
all the structures defined at the finite states of that 
construction, and then put i7(At"l) = A^"! for every 
AN, to obtain a TEHS for 6*. □ 



Theorem 5.8 (Completeness) Let 9 E C and let 

r« be open. Then, 9 is satisfiable. 

Proof. Immediate from Lemma 15.71 and Theo- 
rem [3T0l □ 

As for complexity, for lack of space, we only state 
that it runs within exponential time (the calculation 
is routine). Therefore, the CMATEL(CD+LT)- 
satisfiability is in EXPTIME, which together with 
the EXPTIME-hardness result from [4j , implies that 
it is EXPTIME-complete. 
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6 Concluding remarks 

We developed an incremental-tableau based de- 
cision procedure for the full coalitional multia- 
gent temporal-epistemic logic of linear time CMA- 
TEL(CD+LT). In this case, there is no essential 
interaction between the temporal and the epistemic 
dimensions, which makes the tableau construction 
easier to build and less expensive to run, by reduc- 
ing it to a combination of tableaux for LTL and 
for the (epistemic) logic CMAEL(CD) developed in 
[2] ■ We are convinced that our procedure is — besides 
being rather intuitive — practically much more efR- 
cient than the top-down tableaux, e.g., developed 
for a fragment of our logic in [3], and hence better 
suited to both manual and automated execution. It 
is also easily amenable to modifications suited to rea- 
soning about subclasses of distributed systems, e.g., 
those with a unique initial state. The branching time 
case, which will be considered in a sequel to this 
paper, is essentially a combination of tableaux for 
CTL with those for CMAEL(CD). On the other 
hand, the development of tableau-based procedures 
for those logics from [4] whose satisfiability problem 
has EXPSPACE lower bound is an open challenge. 
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